CVE-2026-102106

9.1 Critique

Publiée le 30/09/2026 à 23:16 · Modifiée le 08/10/2026 à 15:43 · Analysée par le NVD · Source : 9119a7d8-5eab-497f-8521-727c672e3725

Description

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid administrator account could potentially create, modify, or delete internal users and managed domains and change their security-feature configuration without authenticating; deleting a managed domain also removes its user accounts and could lock administrators out of the gateway.

Traduire en français

Produits concernés

Kiteworks Email Protection Gateway
Accellion kiteworks

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	9119a7d8-5eab-497f-8521-727c672e3725	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`

Faiblesses (CWE)

CWE-287

Références

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wwv8-qhqg-4q76 Vendor Advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json Broken Link

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories